This repository has no description
1.8 kB
40 lines
1# sigexec executor: signed remote command execution as root, for
2# administration. The signature is the authorization — commands are signed in
3# the browser (passkey) or by the CLI's local ed25519 key, verified against
4# the key list below; no shell parses them, argv runs literally.
5#
6# There is no TLS here: the port is opened on retiolum only, and the dashboard
7# on neoprism (./dashboard.nix) proxies browser/CLI traffic to it. Machines
8# not reachable over retiolum (starkstrom) additionally put their own nginx in
9# front; see machines/starkstrom/config.nix.
10let
11 # Must match the executor URLs registered in ./dashboard.nix.
12 executorPort = 7601;
13 domain = "sigexec.lassul.us";
14in
15{ self, ... }:
16{
17 imports = [ self.inputs.sigexec.nixosModules.executor ];
18
19 services.sigexec-executor = {
20 enable = true;
21 # root deliberately: this executor's purpose is administration, and the
22 # executor's privileges are the jobs' privileges.
23 user = "root";
24 group = "root";
25 # ssh-style: login shell env, bare command names work.
26 login = true;
27 # Wildcard dual-stack bind; reachability is the firewall's job below.
28 listen = "[::]:${toString executorPort}";
29 # Browser passkeys sign against the dashboard's origin.
30 rpId = domain;
31 origins = [ "https://${domain}" ];
32 authorizedKeys = [
33 "ed25519 RhYj8TzT8w3q50Oi3-q7U1KLRLrm66FltogC15ootJg read,request lass@ignavia"
34 "webauthn-es256 MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZPkoTMJKVdsC-_m8wPrKrJiCKVcZLdJarMTzF8JQFJUKmYlqY_34oQr1u9wCMTQZFU541Jmje1ri9z20XmsXpQ 6KpUo9EZQrmOCQ0vVwgnbw read,write lass@ignavia"
35 ];
36 };
37
38 # Reachable from the mesh only; the dashboard proxies for the outside world.
39 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ executorPort ];
40}